Amazon OpenSearch Service
Search and log analytics
Runs managed OpenSearch clusters (a fork of Elasticsearch) for full-text search, log analytics, and vector search; includes OpenSearch Dashboards for visualization.
- Cost$$$ High
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsSAA · DVA
Think of it asLike a super-fast index for a giant library: type a keyword and get the page.
When to use it
✓ Use it when
You need full-text search, log analytics, or vector search for your app.
✗ Avoid it when
Don't want to manage clusters → OpenSearch Serverless; ad-hoc SQL queries on S3 → Athena.
Common uses
- Product search box for a website
- Centralized log analytics (ELK stack)
- Vector store for RAG applications
What does it cost?
- Pricing model: Charged per hour of node instance runtime, GB of EBS/UltraWarm storage, and data transfer.
Multi-node clusters for HA run 24/7 — use UltraWarm/cold storage for older logs.
When the question says full-text search or near real-time log analytics with dashboards (Kibana/OpenSearch Dashboards), choose OpenSearch Service; for ad-hoc SQL on logs in S3, Athena; for low-latency key-value, DynamoDB.
Frequently asked questions
How is OpenSearch Service different from Athena or CloudWatch Logs Insights for log analysis?
OpenSearch indexes data in a cluster, so full-text search and near real-time dashboards are very fast, but you pay for a continuously running cluster. Athena queries files directly in S3 and charges by data scanned, which is cheap for occasional analysis. CloudWatch Logs Insights suits quick queries on logs already in CloudWatch.
How do I make OpenSearch highly available?
Turn on Multi-AZ so nodes and replica shards spread across AZs, and use dedicated master nodes for cluster stability. Older data can move to UltraWarm or cold storage to cut cost. Data is snapshotted automatically to S3 for recovery.
Can OpenSearch be used as a primary database?
Not recommended. It excels at search, log analytics and vector search, but it is not a transactional database. A common pattern keeps the source data in DynamoDB, RDS or S3 and syncs it to OpenSearch for searching. If you do not want to manage clusters, there is OpenSearch Serverless.
Related services
SAA-C03 study guide
OpenSearch Service is covered in these study modules: